CVE-2026-19901: Use of Hard-coded Credentials

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability ...

CVE-2023-24147: Use of Hard-coded Credentials

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini...

PT-2021-13817

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01 Description: The issue concerns the storage of credentials in plaintext. Specifically, usernames and passwords are stored in plaintext in the config files on the device, such as the file...

CVE-2021-20162: Cleartext Storage of Sensitive Information

Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plaintext in the config files on the device. For example, /etc/config/cameo contains the admin password in plaintext...

PT-2020-11090

Name of the Vulnerable Software and Affected Versions WAGO PFC 200 Firmware version 03.02.0214 Description An exploitable command injection issue exists in the iocheckd service 'I/O-Check' function. This can be triggered by sending a specially crafted packet to the extracted hostname value from a...

CVE-2016-2357

Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory...

CVE-2016-2357: Use of Hard-coded Credentials

Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory...

PT-2019-7817

Name of the Vulnerable Software and Affected Versions Milesight IP security cameras versions prior to 2016-11-14 Description The issue concerns a hardcoded SSL private key located under the /etc/config directory. Recommendations For Milesight IP security cameras versions prior to 2016-11-14,...

PT-2019-19404

Name of the Vulnerable Software and Affected Versions Sangfor Sundray WLAN Controller versions 3.7.4.2 and earlier Description The issue allows remote attackers to achieve full access to the system. This is due to the fact that shell metacharacters in the nginx webconsole.php Cookie header can be...

CVE-2019-9161: Improper Neutralization of Special Elements used in an OS Command

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginxwebconsole.php Cookie header can be used to read an etc/config/wac/wnscfgadmindetail.xm...

CVE-2017-5227: Exposure of Sensitive Information to an Unauthorized Actor

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file...

PT-2017-16402

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.2.4 Build 20170313 Description The issue allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file...

CVE-2014-5457: Undefined Security Weakness

QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password...

CVE-2008-3411: Improper Authentication

The Axesstel AXW-D800 modem with D2ETH10901VEBR Jun-14-2006 software does not require authentication for 1 etc/config/System.html, 2 etc/config/Network.html, 3 etc/config/Security.html, 4 cgi-bin/sysconf.cgi, and 5 cgi-bin/route.cgi, which allows remote attackers to change the modem's configurati...